CVE-2026-72898 is a maximum-severity SQL injection in Metabase's password reset endpoint that let attackers become admin with zero credentials, and it was already being exploited before a patch existed.
Read the full story: Metabase Zero-Day Let Attackers Grab Admin, No Login →
Transcript
A single API endpoint just handed attackers the keys to thousands of company databases. Metabase, the popular analytics tool, had a bug in its password reset endpoint. Send one extra field in the request, and the server treats it as raw SQL instead of data. That gets you full administrator access. No login, no credentials, just a malformed request. From there, an attacker reads every database connected to that Metabase instance and steals the stored credentials too. It scored a perfect ten out of ten on the severity scale, the maximum possible. Two companies, Framework and Tally, already confirmed customer data was stolen this way. CISA added it to its most-wanted exploited list within days. If you're running Metabase yourself, patch immediately, then rotate every database credential it ever touched.